File size: 2,359 Bytes
939c0c0 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 | """
Unit tests for Admin API endpoints and RBAC permission checks.
"""
from __future__ import annotations
import pytest
from httpx import AsyncClient
@pytest.mark.asyncio
async def test_admin_endpoints_access_control(client: AsyncClient):
# 1. Register admin user (first user gets Admin role)
reg = await client.post("/api/v1/auth/register", json={
"email": "admin_test@company.com",
"password": "Password123!",
"full_name": "Admin Tester",
"tenant_name": "Admin Corp"
})
admin_token = reg.json()["tokens"]["access_token"]
admin_headers = {"Authorization": f"Bearer {admin_token}"}
# 2. Admin can list users
response = await client.get("/api/v1/admin/users", headers=admin_headers)
assert response.status_code == 200, response.text
users = response.json()
assert len(users) >= 1
assert users[0]["email"] == "admin_test@company.com"
# 3. Admin can invite a user with employee role
invite_req = {
"email": "invited_emp@company.com",
"full_name": "Invited Employee",
"role": "employee",
"password": "Password123!"
}
response = await client.post("/api/v1/admin/users/invite", headers=admin_headers, json=invite_req)
assert response.status_code == 201, response.text
invited_user = response.json()
assert invited_user["email"] == "invited_emp@company.com"
assert invited_user["role"] == "employee"
# 4. Login as non-admin employee
login_form = {"username": "invited_emp@company.com", "password": "Password123!"}
emp_login = await client.post("/api/v1/auth/login", data=login_form)
emp_token = emp_login.json()["access_token"]
emp_headers = {"Authorization": f"Bearer {emp_token}"}
# 5. Non-admin user MUST be blocked (403 Forbidden) from admin endpoints
response = await client.get("/api/v1/admin/users", headers=emp_headers)
assert response.status_code == 403
assert response.json()["detail"]["error"] == "insufficient_permissions"
# 6. Admin can fetch audit logs and tenant details
response = await client.get("/api/v1/admin/audit-logs", headers=admin_headers)
assert response.status_code == 200
response = await client.get("/api/v1/admin/tenant", headers=admin_headers)
assert response.status_code == 200
assert response.json()["slug"] == "admin-corp"
|